The Supreme Court has held that Richard Lloyd, a prominent advocate of consumer rights, is not entitled to bring proceedings against Google LLC on behalf of more than 4 million Apple iPhone users resident in England and Wales. Mr Lloyd alleged that Google had unlawfully tracked the users' internet activity without their consent in breach of data protection laws.However, the Supreme Court rejected the argument that individuals affected by a data breach are entitled to compensation for loss of control of their data under the Data Protection Act 1998 (DPA) without needing to establish financial loss or distress. Importantly, this meant that Mr Lloyd's action was not suitable as a representative action (i.e. an "opt-out" class-action-type claim).

This was a decision being closely watched by many organisations in a wide range of sectors such as banks, retailers and technology providers.It will be a welcome relief to many, including data controllers who suffer serious cyber or data security breaches that affect large numbers of data subjects.

Its effect is that the immediate prospect of data protection related representative actions being brought in England and Wales looks very slim. While the judgment recognises a theoretical possibility to bringing such claims, the legal and practical challenges of economically doing so were recognised in the court's judgment.

This case also provides further ammunition for defending individual claims for compensation based solely on contravention of data protection obligations resulting in loss of control (as opposed to demonstrable financial loss or distress). These have become increasingly common since the Court of Appeal decision.

However, it remains the case that other forms of group action are available for individuals affected by data protection infringements. These are not directly affected by this decision. And, importantly, it will also raise policy questions about whether issues about access to justice in similar data-related cases should be addressed through a competition-law-style collective proceedings regime in the UK. This is a topical issue given the currently ongoing process of review of the UK GDPR.

Mr Lloyd's claim

In this landmark action for data breach claims, Mr Lloyd alleges that, for several months in late 2011 and early 2012, Google tracked users' internet activity without their consent.During this period, Apple's browser, Safari, was set to block all third party cookies. It is alleged that Google developed and implemented a "Safari workaround" to place its "DoubleClick Ad" cookie on a user's device if they visited a website containing content from Google's DoubleClick domain.It is claimed that the data collected was used for commercial purposes, enabling advertisers to target specific groups of users based on their browsing history. 

Mr Lloyd issued a claim in 2017 stating that Google had breached its duty as data controller under section 4(4) of the DPA to comply with applicable data protection principles. He sought damages on behalf of iPhone users under section 13 of the DPA.Mr Lloyd sought to bring the claim as a "representative action" in terms of Rule 19.6 of the Civil Procedure Rules, which allows a claim to be brought by one or more persons as representatives of others who have the "same interest" in the claim.Crucially, Mr Lloyd claimed that it would not be necessary to establish the individual circumstances of each person represented by the action.Rather a uniform sum of damages could be awarded for each person.

Google is a Delaware corporation.Therefore, Mr Lloyd needed the court's permission to serve the claim form on Google outside the jurisdiction. Google opposed that application on the grounds that: (1) damages cannot be awarded under the DPA without proof that a breach of the requirements of the Act caused an individual to suffer financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action.In the High Court, permission to serve the claim was refused, with Google's grounds of opposition upheld.In 2019, the Court of Appeal overturned the High Court ruling and allowed Mr Lloyd's action to proceed as a representative action, holding that damages for loss of control of data are recoverable even where financial loss or distress is not shown. 

The Supreme Court's decision 

On Wednesday 10 November 2021, the Supreme Court handed down its judgment in Google's appeal.The Supreme Court unanimously allowed the appeal and restored the High Court's decision to refuse permission to serve the proceedings on Google.Lord Leggatt gives two reasons for the Supreme Court's conclusion.

First, compensation can only be awarded in terms of section 13 of the DPA where it is established that an individual has suffered "damage", meaning either financial loss or distress.It was not correct, as Mr Lloyd had claimed, that the DPA allowed for compensation on the basis of non-trivial contravention of the obligations of the DPA alone. Some form of damage to the data subject must be established and evidenced.Mr Lloyd's claim that it was sufficient for a claimant to allege a "loss of control" over their personal data was rejected.Lord Leggatt found no basis in the DPA for such claim.He also rejected the argument that permitting recovery of damages on the same grounds as claims for "misuse of private information" was appropriate.

Secondly, proof of individual circumstances would be required, with the following questions being relevant to the assessment of damages: over what period of time did Google track the individual’s internet browsing history? What quantity of data was unlawfully processed? Was any of the information unlawfully processed of a sensitive or private nature? What use did Google make of the information and what commercial benefit, if any, did Google obtain from such use?Such questions could not be addressed in a representative action on behalf of millions of users.

The consequence of these two conclusions was that it was not possible to demonstrate that the 4 million affected iPhone users all shared "the same interest".Instead, each affected data subject would have suffered different damage.As such, the proceeding could not be brought as a representative action.

Implications of the decision

The applicable provisions of the DPA considered in the case have since been repealed, but the judgment is of significance to the interpretation and development of the new data protection landscape, namely, the General Data Protection Regulation (GDPR) and Data Protection Act 2018.It is not apparent that the differences in wording between the old and new regimes provide any basis to argue that this case would have been decided differently had the current legislative framework applied.The judgment does recognise that there remains the possibility that representative actions may be theoretically possible through a bifurcated mechanism by which only liability is established (with separate proceedings then being needed to assess damages on an individual basis).In practice, this approach would usually be uneconomical.

Following the Court of Appeal's decision, there was much speculation as to whether the case had the potential to open the floodgates to an array of class action claims in respect of breaches of the GDPR.Claimant lawyers and litigation funders have become increasingly active in the market in recent years in lining up class action data breach claims.The Supreme Court's decision seems likely to effectively rule out such activity other than in very narrow circumstances, and one might expect litigation funders to respond to the judgment by withdrawing support for similar claims.

This remains to be seen in practice, but on the face of it, the prospects of successful class-action-style compensation claims in the UK seem to have been reduced. This will be welcome news for data controllers who have been concerned about the implications of such claims, especially in relation to cyber and data security breaches.Having suffered a serious breach (often as a result of criminal activity) with all the operational and financial consequences that this entails, and potentially facing significant fines and reputational damage, controllers have been increasingly concerned about the prospect of additional liability to pay potentially very significant damages for loss of control over personal data on a representative action (i.e. "opt out") basis.

With respect to representative actions more generally, the judgment confirms the strict interpretation taken by the English courts to the requirement that the relevant claimants have "the same interest in a claim", a point recently demonstrated again in the Court of Appeal's decision of last month in Jalla v. Shell International Trading and Shipping Co Ltd [2021] EWCA Civ 1389.

However, other forms of group litigation actions are unaffected by this decision.Most notably, the potential for Group Litigation Orders (GLOs) to be brought in the event of data breaches or other forms of data protection infringement remains live, albeit that the court's ruling with respect to the unavailability of loss of control damages under the DPA 1998 will constitute a significant practical hurdle for data subjects who wish to proceed in this way.This ruling likely re-emphasises the GLO route as the primary way in which mass data protection actions will arise.And we would not expect them to stop as a result of this decision. However, in GLO actions, claimants have to "opt in".

While overall a very positive decision for data controllers, one further note of caution arising from the judgment is the spectre of collective proceedings.These are "opt-out-style" actions that can be introduced on a sector-by-sector basis. The only example of this in the UK currently relates to claims for breach of competition law.Whether this judgment will result in a call for similar actions relating to data protection, particularly in light of the current government's approach to Big Tech, is yet to be seen. The currently ongoing review of the UK GDPR may provide the opportunity to introduce them. 

In short, data controllers are entitled to breathe a sigh of relief today. However, the risk of collective data protection actions has not gone away.